ANALYSIS · 2810eeab· FINISHED 2026-01-08 · PATCHDIFF

Folder Analysiscache/quiz-master-next_10.3.1 → cache/quiz-master-next_10.3.2✓ COMPLETED

Files42

Vulnerable8

True positives4

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2025-9637

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 42 CVE 1 Vuln 8

SORT

1 files · page 1/1

php/classes/class-qmn-quiz-manager.php

AI: 3 vulnerabilities

CWE-639: Authorization Bypass Through User-Controlled KeyCWE-843: Access of Resource Using Incompatible Type ('Type Confusion')CWE-521: Weak Password Requirements CVE-2025-9637 2 TP 1 FP

#%!d(float64=019)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2025-9637

Security writeup for CVE-2025-9637

✓ 1 FILE

## The Exploit

Attacker needs no authentication.

```bash
curl -s -X POST 'https://TARGET/wp-admin/admin-ajax.php' \
  -d 'action=qsm_get_quiz_to_reload&quiz_id=123' \
  -H 'Content-Type: application/x-www-form-urlencoded'
```

The vulnerable endpoint returns quiz data instead of `0` or an authorization error. In practice, the response contains unpublished/private quiz metadata and question markup from QSM, confirming unauthorized access to quiz details.

## What the Patch Did

Before:

```php
add_action( 'wp_ajax_qsm_get_quiz_to_reload', array( $this, 'qsm_get_quiz_to_reload' ) );
add_action( 'wp_ajax_nopriv_qsm_get_quiz_to_reload', array( $this, 'qsm_get_quiz_to_reload' ) );
```

After:

```php
add_action( 'wp_ajax_qsm_get_quiz_to_reload', array( $this, 'qsm_get_quiz_to_reload' ) );
```

The patch removed the unauthenticated AJAX hook registration. That means `admin-ajax.php?action=qsm_get_quiz_to_reload` can now only be invoked by a logged-in user, restoring the WordPress AJAX authentication boundary.

## Root Cause

This was a missing access-control check in WordPress AJAX registration, a CWE-862 / CWE-639 issue. The attacker-controlled `action=qsm_get_quiz_to_reload` parameter was accepted by the WordPress AJAX dispatcher and routed to `qsm_get_quiz_to_reload()` even for unauthenticated requests because the plugin registered a `wp_ajax_nopriv_*` callback. The trust boundary crossed unchecked was “public HTTP request → privileged quiz reload handler”, allowing unauthenticated users to read unpublished/private/password-protected quiz details.

## Why It Works

The load-bearing fix is the removal of the `wp_ajax_nopriv_qsm_get_quiz_to_reload` hook. Without that hook, WordPress will not dispatch this AJAX action for non-logged-in users. The remaining `wp_ajax_qsm_get_quiz_to_reload` registration still allows authenticated users to reload quizzes as intended. The patch likely also relies on internal quiz status checks in `qsm_get_quiz_to_reload()` itself, but the critical security change is simply not exposing that callback to anonymous requests.

## Hardening Checklist

- register anonymous AJAX endpoints only with `wp_ajax_nopriv_*` when public access is explicitly required.
- enforce capability checks inside callbacks with `current_user_can()`, for example `current_user_can('edit_qsm_quizzes')`.
- protect password-protected content with `post_password_required()` before processing submissions or exporting quiz data.
- require and validate nonces for state-changing AJAX actions using `check_ajax_referer()`.
- verify post status and visibility before returning quiz metadata to any AJAX request.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2025-9637

CVE CVE-2025-9637

PRODUCT Folder Analysis

AFFECTED ≤ cache/quiz-master-next_10.3.1

FIXED IN cache/quiz-master-next_10.3.2

STATUS Generated

Security writeup · CVE-2025-9637

Source files · 1

php/classes/class-qmn-quiz-manager.php Linked

↗ NVD